MZ@ !L!This program cannot be run in DOS mode. $Q???>?,?Q?R?C?G?Rich?PELFI! P>`YPj`P.textDF h.rdataL` J@H.datapT@INIT V .rsrc`@B.relocd@BUjhghdTdPd%SVWeEjjj}WE P,au؅V0aFt^ jjjjjV4a؅jjjWMQ,a} EjjW8aGtG jjjjjW4au܅tKURjVC EE;Es&SuE#}D "uT9]rJEaMЉ]3uE+ËeE>uE#}H "uV9]rLEaBMЉ]3uE+ËeE>uE#}L "ur9]rh9]rcUȋ|S a;AsHE UЉ]3uE2ËeE>uE >#}P "9]}Eȋ0xa;p]H`E E%"E a<]ËeEE"ML`E]3)ËeE]3 >#}X "}}rdMȋqvA;uwuE#ËeE>uE}؈ "uZE9Er>MȋYv;]wSPQuu$]#ËeE>uE}\ "E }Eȋ8pvtŨ;wjE H` E%"VEȃPW> E"L`3u܉uE :Ëe>uE #ËeE>uE}` "ua}rVE `v2pa pUЉ E3uE&ËeE>uE#}؀ "u'}rEȋM`vE30a3#}؄ "u,}r!`MaUEЉfMfHE3#}h "p9]}E UREPaMQjjaPjjj@MQ=u Ep8}]3u aE&ËeE>uE#EpU܉PƋMd _^[]UjhghdTdPd%SVWeu3;t:]ff^f} PjaF;tff~ ËeEMd _^[]UjhghdTdPd%SVWeu3;t1}f9~vF;tWP`f>f~ ËeEMd _^[]UjhghdTdPd%SVWeut=ENfvFtQjPJ; f ËeEMd _^[]UjhghdTdPd%`SVWe38p8phpp;E]E@Ep]ȉ]SSSj SjhSMQURhhpP qP:;} pQ:SShpSX`PS pQ`;}*pRN:pPI:Md _^[] phSQ9 E+Ѝ$f f;uU ;9Z]3ɉM;}BHf9uf*EËeE3ۋU BЍd$ff;u+fOf;uȋȃE;;u$d$fGf;uaffGf;uxaRhpaMQ` Eff;u+fOf;uȋȃ󤍽IfGf;ulaIfHf;u dafhafPPff;u+8 ptFPMQajUREP`uCSSMQSUREPS pQpRSSMQSRPSpP pQ7Md _^[] ̃Vt$ VT$RD$Ph@d|$ 4} uuSL$ QRjx`pD$ P_^3[]USVWhD$PR]WL$$hdQ` T$ RD$PaL$ QT$ RD$PS uZL$ QjT$RD$PL$Qhldt$ X} uuCT$ RPjx`dL$ Q$_^3[]USVWhD$PruWL$$hHeQ` T$ RD$PaL$ Q؍T$RD$Phd\$ D} uuVL$ QRjx`fD$ P_^3[]̃VWhhplhhp]5aheD$ P֋|$hpL$ QW7upheT$ RhpD$ PW_^uPhph`eps̀=pt# p apPr pQlhp*hp ̋L$SjD$$PjjjQ2`} 2[ T$ VR`jjD$P`D$8L$QL$8T$RT$8jPD$tV_^Y 'jjMtPVuVq3SP` qӊС$qs$q qD`=D` q׋T$B L$ QPzL$ ӋL$ yueAL$ `jhp`jhqUjhqjhqjhqp`` ׋L$ Qt[_^Y ̀|$ uD$VP t VR VL ^ ̃V5aheD$P֍L$Q`tvh<=qt$heT$R֍D$ P` qQ` qR4qjP`hp`3^^̃ q$PjjjQD$D$} $$Vt$@L$V jQjR| D$Pm qL$QjjjR}D$PH^N T$ D$NjPjQE| T$R3^`08v 0VB]}R^0Wj0L$ jQ`|$H ffD$0fD$ D$ D$pD$lpf;h qT$ R=WL$$D$(=hzbRPhjt`qt$@Vhqfqh`W  u1qjP` qQ `_^0hp q`}6 `qjR` qP_^0V>jV& qQ}>hp`t qjR` qP]_^0h<`}Bhp`' qjQ` qRb_^0_3^0̋D$DSUV3҃Wq9yyytqyyytq yyy tq y y t fp PH@#ދ# |$ލxj#؋# |$V ȋ## |$ٍp $#ڋ# |$ ڍ7ν#ދ# |$$ލ|#؋# |$(*ƇG ȋ## |$,ٍF0ы## |$07F#ދ# |$4ލؘi#؋# |$8D ȋ## |$<ٍ[#ڋ# |$@ڍ7\#ދ# |$Dލ"k#؋# |$Hq ȋ׋#ދ# \$L鍔CyыӉ\$## #l$Pݍ3!I# |$ڍb%|$## |$,@@ ȋ## |$@QZ^&ы## |$ٍ7Ƕ#ދ# |$(ڍ]/Ƌ## |$<SD ȋ## ы## |$$7## |$8ڍ!#؋# |$L7 ȋ## |$  ы## |$4ٍ7ZE#ދ# |$Hڍ#؋# |$ ȋ## |$0ogы## |$D7L*33|$(B9Ƌ33|$4q 33L$@ߍ"am3ڋ3L$L1 83\$3D꾤3t$$>K 33|$0`K֋33\$< p3|$H~(33|$7' 33|$ 03׋3\$, 3T$89ً33T$D2 Ћ33>|33|$eV΋ 3|$D") 3|$0*C Ћ 3|$L7# 3|$(9΋ 3|$DY[e 3|$   3|$<7} 3|$]΋ 3|$4O~o 3, Ћ 3|$,7C 3|$HN΋ 3|$$~S 3|$@5: Ћ 3|$7*|$X_ 3D$8_ӆG ƉG GƉGG‰G_^][D̋D$@@#Eg@ @ܺ@vT2S\$Ul$Vt$W>?ۍN9NsNtH@~ @+D$UPL7Q / @|RD$ (L$NV+ l$@|!ڍIV@utSUVw _^][ ̃Vt$L$L$NT$L$T$ L$ D$+W?Qh8fVT$jT$ RV|$3$ȃɋTT8|_^̋T$ `qVr % ;t ;p t;uAB Q^2^̋D$L$hzbTCPQt`u@@@ Vt$`jh(q`Fu;tNHjV`(q``^̋D$SVt$ F `jh(q`V(q``^[V`jh(q`L$`q%4;t ;N t6;u(q``3^F(q``F^hzbHThjt``qth(q``q} jP`2ù@uS`UVW3d$`q<(;t0jP;ur؋ `qjQh(q`_^][3Vt$f9t uu t|+7^^Vt$W|$t>s D$ _^ S\$jhxfS` ut>C[_^ [_^ ̃4ft5f2u_^]f [ |$ˋt$뚅uf_^][ ̃|$Vt$fs;S\$f;\W|$thfWV}_[2^SWV_[^D$ L$PQV^U@SUVW`jhq`5hqhqX38^F%|0)8f9/~%hgrTBhjt`; NhUWQ UT$RaD$P/;SSSj jjhST$@R qD$\PL$@hL$lL$@QWR\$LD$p\$tD$|@$$|aL$D$(PWQtCq`jhq`T$(D$,L$0VT$4FNhqVF`D$PTWTSU`6hqq``_^][]%(a%$a%a%a%8`%4`%0`%,`%(`%$`% `%`%`%`%`% `%`%`%`%<`XB*ȇzjRF6lrƒރ":Rbʄ؄V $<Zrą܅2TpJ*̂hPF2"ЁImagePath )%X - failed (0x - succeededErrorControlDisplayNameTypeStartDelete File \Registry\Machine\System\CurrentControlSet\Services\CopyStatus=%XSize=%iVirus=BootCleaner quarantine.datInfected=Src=[InfectedFile].ini.dtabcqr%.5d Quarantine File QuarantineFile QrFile%iQuarantine service file QrSvc%iCopy File CpFileT%iCpFileF%iDeleteFile DelFile%iDelete Service & File DelSvc%iDisable Service DisableSvc%iDelete RegKey DelRegKey%iDelete Service DelSvcReg%iQuarantine path: QrPathLogFile\??\klif\??\klbg007\Device\klbg007PsRemoveCreateThreadNotifyRoutine\\?\\registry\machine\system\currentcontrolset\services\SystemRoot\+1PV U["(PV w})/*0 !!%%,---PazbICzbVC;҆X`.D`P`XB*ȇzjRF6lrƒރ":Rbʄ؄V $<Zrą܅2TpJ*̂hPF2"Ё3IoFreeMdlgMmUnlockPagesGMmIsAddressValidYMmProbeAndLockPagesQMmMapLockedPagesSpecifyCache6MmBuildMdlForNonPagedPoolIoAllocateMdl_except_handler3memsetObfDereferenceObjectObReferenceObjectByName-IoDriverObjectTypehRtlInitUnicodeStringKeServiceDescriptorTablePsGetCurrentProcessId:IoGetCurrentProcessmemcpy7ExAllocatePoolHExFreePoolWithTagRtlUnicodeStringToAnsiStringswprintfObReferenceObjectByHandle0IoFileObjectTypeZwClose*ZwDeleteKey@ZwOpenKeyRtlCopyUnicodeStringRtlUnicodeStringToIntegerYZwQueryValueKey:ExAllocatePoolWithTag-RtlDeleteRegistryValueRtlWriteRegistryValueKeWaitForSingleObjectIofCallDriver IoBuildDeviceIoControlRequestKeInitializeEventDIoGetRelatedDeviceObjectPsGetCurrentThreadId?ZwOpenFileKeDelayExecutionThread$ZwCreateFilewcsrchrKeLeaveCriticalRegionsExReleaseResourceLite3ExAcquireResourceSharedLiteKeEnterCriticalRegionIofCompleteRequest%IoDeleteDevice!IoCreateSymbolicLinkIoCreateDevice'IoDeleteSymbolicLink2ExAcquireResourceExclusiveLiteAExDeleteResourceLiteCMmGetSystemRoutineAddressPsSetCreateThreadNotifyRoutinePExInitializeResourceLite{NtBuildNumberInitSafeBootModewcsncmp0ZwEnumerateKey<ExConvertExclusiveToSharedLitentoskrnl.exePKfLowerIrqlHKeRaiseIrqlToDpcLevelRKfReleaseSpinLockOKfAcquireSpinLockHAL.dllFltWriteFileFltClosemFltObjectDereference"FltCreateFileFltReadFileFltReleaseContextnFltObjectReferenceXFltGetVolumeContextZFltGetVolumeFromFileObjectKFltGetInstanceContextFltUnregisterFilterFltSetVolumeContextFltSetInstanceContextFltAllocateContextFltStartFilteringFltRegisterFilterFLTMGR.SYS0"H`4VS_VERSION_INFO?StringFileInfo040904B0<CompanyNameKaspersky Labn%LegalCopyrightCopyright Kaspersky Lab 1996-2008.CLegalTrademarksKaspersky"! Anti-Virus is registered trademark of Kaspersky Lab.JProductNameKaspersky Anti-Virus4ProductVersion1.0.0.00FileVersion8.0.8.2JFileDescriptionKLBG Mini-Filter*InternalNameKLBG: OriginalFilenameKLBG.SYSDVarFileInfo$Translation 0 0=0Q0m000001A1K1v1{112228222U3334C455R6Y687F7|7778V8[8888V9[9}99999999::: :*:5:T:R;r;z;;;;<3>Y>}>>>>>?c?v?????0T-0Z000013111112l2s2222 33'3`333333#4[4j4u4z44444444445555'5Z5s555556(686C6N66666666667Q7[7q7x7777B8P8f8s88888889 9999999(:T:b:h:y::::::: ;;$;E;M;X;b;h;o;;;;;; <<< <^>>????*?K?R?b?i?q??????????@0-030C0L0Q0k0q0z00000e99$:Z:a:g:::::::::::::; ;,;2;8;G;M;S;n;u;|;;;;;;;;;v<}< =*=?=L=a===(>>>>>>>>>>>>?'?]?v???????P|0000 0-080>0B0H0L0R0u00011r222222%3S3333334 484@4K4Q4W4f4l4r4x4~4444444444444444`d77$7(70747<7@7H7L7T7X7`7d7l7p7x7|77777777777777777778888$8(84888D8H8p 0t00 *H 01 0 +0h +7Z0X03 +70% <<<Obsolete>>>0!0 +VјpEaiw 0z0b8%a&Z0  *H 0S1 0 UUS10U VeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA0 070615000000Z 120614235959Z0\1 0 UUS10U VeriSign, Inc.1402U+VeriSign Time Stamping Services Signer - G200  *H 0ĵR`)J[/Kk5TX56^bMRQ4q{f*j 7٘tvJcEG.k NK+XJ,XB-uލǎlLgrIž`<cxi{-004+(0&0$+0http://ocsp.verisign.com0 U003U,0*0(&$"http://crl.verisign.com/tss-ca.crl0U% 0 +0U0U0010 UTSA1-20  *H PK$ $- 7 ,Za񑑳V@뒾89u6t:O7ʕBǠWdB5N3M'L8MxSݤ^ ⥾`߭(ǥKd[98"3/!?DA e$HDT\y>]r},CS}=*:Om ]^SWp`+nx'4[^I2300-GߍRFCmH 10  *H 01 0 UZA10U Western Cape10U Durbanville10 U Thawte10U Thawte Certification10UThawte Timestamping CA0 031204000000Z 131203235959Z0S1 0 UUS10U VeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA0"0  *H 0 ʲ }uNgadڻ30X~k6xw~o< hlʽR-H=]_/kLR`@~ ?Ǵ߇_zj1.G 1s W-x43h/Š*Ë!fXWou<&]'x1"ijGC_^|}bM "Vͮv M٠h;004+(0&0$+0http://ocsp.verisign.com0U00AU:0806420http://crl.verisign.com/ThawteTimestampingCA.crl0U% 0 +0U0$U0010U TSA2048-1-530  *H JkXD1y+LͰXn)^ʓR G'/8ɓN"b?7!Op18UN$ҩ'NzaA*^ݻ+>W~ +;R8'?J00(AZ9xIef8Lu0  *H 0_1 0 UUS10U VeriSign, Inc.1705U .Class 3 Public Primary Certification Authority0 040716000000Z 140715235959Z01 0 UUS10U VeriSign, Inc.10U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 CA0"0  *H 0 ~7O8Ҍ} kBRH%czQeӪ;+f$n96Уv"'$l8'I%,0q(wJQTom dc-N'm)G|-Wg32 #m„Kvhq,]! &-+UMm5(k\٪_̓c";Bi:^,(Sݵ Qp7HRHo8l{D00U00DU =0;09 `HE0*0(+https://www.verisign.com/rpa01U*0(0&$" http://crl.verisign.com/pca3.crl0U%0++0U0 `HB0)U"0 010UClass3CA2048-1-430UQ==d6|h[x߹70U#y0wca0_1 0 UUS10U VeriSign, Inc.1705U .Class 3 Public Primary Certification Authorityp)48{̺0  *H :J{UdU@IA.x#h2و8?Ӊ?Z.&|n H @yg#$P.̀lROuU"Au/cU}TZY4_^z00ݠw軒|eA(0  *H 01 0 UUS10U VeriSign, Inc.10U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 CA0 080221000000Z 090313235959Z01 0 URU10 UMoscow10 UMoscow10U  Kaspersky Lab1>0<U 5Digital ID Class 3 - Microsoft Software Validation v210U Technical dept10U Kaspersky Lab00  *H 0R9]m5V5Dx}U^튂5 [7*EdEO]FD ?y4"|Z" bó86(bj+Qihʦcr0c07y52fy*Bh i0{0 U00U0@U9070531/http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0DU =0;09 `HE0*0(+https://www.verisign.com/rpa0U% 0 +0u+i0g0$+0http://ocsp.verisign.com0?+03http://CSC3-2004-aia.verisign.com/CSC3-2004-aia.cer0U#0Q==d6|h[x߹70 `HB0 +700  *H e M Sg, { O}ټŷ~S6LL7'qcZ@s1;gϾ5,ڠ#sWK6s?Np>fܠɈW/~hU|>mRt OKKdH 9"kJ` 00 a 0  *H 01 0 UUS10U Washington10URedmond10U Microsoft Corporation1)0'U Microsoft Code Verification Root0 060523170129Z 160523171129Z0_1 0 UUS10U VeriSign, Inc.1705U .Class 3 Public Primary Certification Authority00  *H 0\Y@WjE@ 3X%*Dx#}֬cEr'Luq9OBu Ǝ o#_p)6Ɇ籚 S=}$E3vqdLe.hE#00U  00U 06 +7)0'+7щNלӿn0 U0U00U{wߞ ?.iw0 +7CrossCA0U#0b ![Cn TPkҖq0UUN0L0JHFDhttp://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0  *H F;Eu~_CFˊGAt9QG{W2|?B!JCJo\KџLUn %qNg˂׎U7>n.aAHu,(I$s%<̈ (LeT^,Q:G<5ITJK}yϿ5\9QDD4*\;)N7~uմ nl#qgqNt LX^m9ˆ?2mב6Gx'*hONg?-@aH1s FVI) ڣ`TY(TfLۦg.Q{49AŒh&$ 灎 -/HoSIdx] U&ﺍѥ/Zka3b$v/C|4$(UuN1+gc׫s Y?*Eb[/9_sG*CbU==&}bU֔4Me1e0a001 0 UUS10U VeriSign, Inc.10U VeriSign Trust Network1;09U 2Terms of use at https://www.verisign.com/rpa (c)041.0,U%VeriSign Class 3 Code Signing 2004 CAw軒|eA(0 +p0 +7 100 *H  1  +70 +7 10  +70# *H  1Cs9 i]g0  *H )#!k-,:ܹ,eyrWz16|rdWѐO`gyB8-C^;Ԣ̌KǺ_zڬnao9sD.lOTJ$0{ *H  1l0h0g0S1 0 UUS10U VeriSign, Inc.1+0)U"VeriSign Time Stamping Services CA8%a&Z0 +]0 *H  1  *H 0 *H  1 081215164128Z0# *H  10D8 )0  *H 76h z'E-ji}lNL|xQ,6=}3xZkh5)hNQ?${3l&EMO<퀈wId<8|#&zT2hq+%ĪmK